Add protected soft deletion for research runs

tests/test_deletion_protection.py

@@ -0,0 +1,19 @@
+"""Focused tests for deletion-protection primitives without external providers."""
+
+from __future__ import annotations
+
+import pytest
+
+from nsct.security.deletion_protection import hash_deletion_password, verify_deletion_password
+
+
+@pytest.mark.asyncio
+async def test_deletion_password_is_salted_and_verifiable() -> None:
+    password = "a-long-enough-deletion-password"
+    first = await hash_deletion_password(password)
+    second = await hash_deletion_password(password)
+
+    assert first != password
+    assert first != second
+    assert await verify_deletion_password(password, first)
+    assert not await verify_deletion_password("incorrect-password", first)